Fixed a string passed to a query, replaced with a prepared statement